CVE-2026-60237: Oracle Coherence Information Disclosure

CVE-2026-60237 Overview

CVE-2026-60237 is an information disclosure vulnerability in the Oracle Coherence product of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via TCP can exploit this weakness to gain unauthorized read access to a subset of Oracle Coherence accessible data. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Oracle addressed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can retrieve a subset of Oracle Coherence data over TCP without user interaction, leading to confidentiality loss across affected Fusion Middleware deployments.

Affected Products

Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60237 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60237

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used within Oracle Fusion Middleware to distribute application state across clustered nodes. The vulnerability allows an unauthenticated attacker to reach the Coherence service over TCP and retrieve data that should be restricted. Exploitation requires no privileges and no user interaction, and the attack complexity is low. Successful exploitation results in unauthorized read access to a subset of data accessible through Coherence. Integrity and availability remain unaffected, so the flaw is strictly an information disclosure issue.

Root Cause

The issue maps to [CWE-200], Exposure of Sensitive Information to an Unauthorized Actor. The Coherence Core component exposes data through its TCP-based cluster protocol without enforcing sufficient access controls for the affected operations. Oracle's advisory does not disclose the specific internal function or protocol message responsible for the exposure.

Attack Vector

The attack vector is network-based. An attacker sends crafted TCP traffic to a reachable Coherence cluster port and receives back data elements from the grid. Because authentication is not required, any host with network reach to the Coherence listener can attempt exploitation. Deployments that expose Coherence ports beyond trusted management networks are at highest risk. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60237

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default 9000, 7574, and dynamically assigned unicast ports) from hosts outside the application tier.
Outbound data transfers from Coherence nodes to unrecognized external IP addresses.
Anomalous read query volume in Coherence access and cluster logs without corresponding application activity.

Detection Strategies

Inspect Coherence and WebLogic logs for unauthenticated cluster join attempts or extraction requests originating from non-application subnets.
Correlate NetFlow or firewall logs to identify TCP sessions to Coherence ports from unexpected sources.
Baseline normal cluster member communication and alert on new peers or clients that appear without change-management approval.

Monitoring Recommendations

Enable verbose Coherence audit logging and forward events to a centralized SIEM for retention and correlation.
Monitor egress traffic volume from Fusion Middleware hosts to detect bulk data reads consistent with grid scraping.
Track unpatched Coherence versions (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) in the asset inventory until remediation is confirmed.

How to Mitigate CVE-2026-60237

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence deployments running the affected versions.
Restrict TCP access to Coherence cluster ports so only application-tier hosts can reach them.
Inventory all Fusion Middleware instances that embed Coherence and confirm patch status before returning them to production.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the corresponding Coherence bundle patches for versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Workarounds

Place Coherence cluster ports behind network segmentation and deny inbound traffic from untrusted zones.
Enable Coherence Security Framework authentication and TLS for cluster and Extend client communication.
Disable or firewall off any Coherence*Extend proxy that is not required for application functionality.

bash

# Example iptables rule restricting Coherence cluster port 9000 to the application subnet
iptables -A INPUT -p tcp --dport 9000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP